diff --git a/ROUTER.sh b/ROUTER.sh index e3e917d..7440726 100644 --- a/ROUTER.sh +++ b/ROUTER.sh @@ -54,18 +54,18 @@ sudo iptables -A INPUT -i lo -j ACCEPT sudo iptables -A OUTPUT -o lo -j ACCEPT #sudo iptables -t nat -A POSTROUTING -i enp0s9 -o enp0s3 -j MASQUERADE #SUS sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #CAREFULL +sudo iptables -I FORWARD -j NFQUEUE --queue-bypass +sudo iptables -I INPUT -j NFQUEUE --queue-bypass #DNS name resolution requests sent to outside servers and want a response: sudo iptables -A INPUT -i enp0s10 -p udp --dport 53 -j ACCEPT #SSH connections to the router system that originate from the inside and want an answer: sudo iptables -A INPUT -i enp0s9 -p tcp --dport 22 -j ACCEPT sudo iptables -A INPUT -i enp0s8 -s 23.214.219.133 -p tcp --dport 22 -j ACCEPT #The dns server should be able to resolve names using the internet (and others???) -sudo iptables -I FORWARD -j NFQUEUE --queue-bypass -sudo iptables -I INPUT -j NFQUEUE --queue-bypass sudo iptables -A FORWARD -i enp0s8 -o enp0s10 -s 23.214.219.130 -p udp --dport 53 -j ACCEPT #The internal network should be able to send and recieve dns name resolutions to the dns server (1!) sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.130 -p udp --dport 53 -j ACCEPT -sudo iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT #THIS IS IMPORTANT AND MIGHT FUCK US +sudo iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT #The dns and dns2 servers should be able to synchronize the contents of DNS zones. (protocol tcp port 53) sudo iptables -A FORWARD -i enp0s8 -o enp0s10 -s 23.214.219.130 -p tcp --dport 53 -j ACCEPT #SMTP connections to the smtp server and returns